Negotiating Contracts That Will Keep our Clouds Afloat: You re going to put THAT in a cloud? Meteorologist: Daniel T. Graham

Save this PDF as:
 WORD  PNG  TXT  JPG

Size: px
Start display at page:

Download "Negotiating Contracts That Will Keep our Clouds Afloat: You re going to put THAT in a cloud? Meteorologist: Daniel T. Graham"

Transcription

1 Negotiating Contracts That Will Keep our Clouds Afloat: You re going to put THAT in a cloud? Meteorologist: Daniel T. Graham

2 The dynamic provisioning of IT capabilities, whether hardware, software, or services from a third party over the network Accenture, 2009 Cloud computing may be viewed as outsourcing of these capabilities. Maintaining control over the unpredictability of the forecast. Should you stay indoors or venture out? 2

3 1. Security 2. Performance 3. Audit 4. Remediation 5. Mobility 3

4 First, consider the criticality of software, data, or services in question: 4 Non-core business tools or routine, non-sensitive data? Might make sense for looser contract terms, low cost Mission critical systems, regulated personal data, or sensitive business intelligence? Data ownership/security issues must be specified in contract Failure to do so could expose you to serious violations of applicable privacy and export laws Examples: private cloud, data encryption, geographic restrictions

5 Data should be replicated and continuously updated to be unaffected by outages or disasters Vendor should provide real-time data streams from intrusion detection systems If vendor has any kind of breach in its cloud, you should immediately receive notification Vendor s obligations should be specified in the event of a virus, hacking or denial of service attacks 5

6 7 Security Issues to Consider for Cloud Contracts: 1. Privileged User Access 2. Regulatory Compliance - Confidentiality 3. Data Location 4. Data Segregation 5. Recovery 6. Investigative Support 7. Long-Term Viability - Transition 6 - Gartner, 2008

7 1. Privileged User Access Get as much info as you can about the people who manage your data are they all in-house? Hiring and oversight of privileged administrators and the controls over their access 2. Regulatory Compliance 7 Vendor should comply with audits and security certifications. Is it SAS 70 / ISO certified? Are you licensing vendor software? Do you have permission to use?

8 3. Data Location Private cloud? Is the vendor merely a subcontractor? Ask provider to commit to storing and processing data in specific jurisdictions Contractual commitments to obey local privacy laws 4. Data Segregation Vendor should provide evidence that encryption schemes are in place and tested 5. Recovery 8 Vendor should have ability to do complete restoration in case of disaster

9 6. Investigative Support Cloud services can be especially difficult to investigate Logging and data for multiple customers may be co-located and/or spread across an ever-changing set of hosts and data centers. Vendor should give you a contractual commitment to support specific forms of investigation. E-discovery may be important. If subpoenaed, how do I get the information to comply with the Court s order? 7. Long-Term Viability Transfer of Data 9 Verify that data will be transferred in the event your provider ceases to exist, is acquired or contract ends.

10 Seek a balance between importance of cloud resources and what you can afford for performance premiums Change Management processes to be described Service level requirements, performance metrics and thresholds should be stipulated in contract for business continuity: Average application response times, transactions per second, monthly downtime figures, vendor help desk support response time, hardware and software maintenance 10

11 Ask for customer references to gauge vendor s performance record Contract Example: City of Los Angeles Google services contract limits downtime to no more than 5 minutes per month before stiff penalties kick in for the vendor Set performance goals and clawback of fees if performance standards are not met. Is pricing clear? Based on usage or load, or both? 11

12 SLA - Downtime Severity Levels I-III: Define them so that you can understand what and when solutions will be offered in the event of: I. Halt in Business II. Business impacted, but workaround III. Non-critical Set Performance Standards: o Availability based on written criteria: the 9 s. Example: 99.9 % equates to 40 minutes down/month. 12

13 Demand transparency! Actively monitor your vendor s performance for glitches Vendors should document system uptime and processing rates via monthly reports or electronic dashboards 13

14 Vendor should authorize customer to audit its electronic and physical security practices: On-site visits, interviews with employees Ask questions about the qualifications of vendors architects, coders, operators Confirm vendor s risk-control processes, level of testing done to verify service is functioning as intended, and that vendor can identify vulnerabilities These audits are essential as the cloud becomes a part of customer s functional data center under government security regulations 14

15 Avoid contracts that lack consequences for vendors that don t meet their contractual obligation Be wary of a vendor who agrees to everything If penalty for failing to deliver is insignificant, can be cheaper for vendor to fail than to follow through Breakdowns like excessive downtime should incur monetary penalties Examples: refund for a portion of your service fees, service credits or days of free service added 15

16 Security violations should incur more serious consequences: termination/exit rights if provider fails to notify of security breach As is warranties? What is the vendor proposing it will do if there is a problem? Dispute Resolution procedures define them Contract Example: Los Angeles/Google apps contract entitles Los Angeles to minimum award of $10,000 if any data compromised with power to seek unlimited damages if violation egregious. 16

17 Lack of data compatibility standards can make it difficult to move data/applications from one provider to another 17 Contract should explicitly provide that you remain the sole owner of your data, no matter where it physically resides You should have ready and unlimited access to data You should have the right to get data back at any time You should be able to get data back without restrictions upon termination of agreement contract should have provision requiring vendor to provide termination assistance when contract ends

18 Movement of data may involve transfer from servers in one jurisdiction to servers in another Could invoke different jurisdictional-dependent discovery rules, privacy laws and data-transfer restrictions You may want to restrict/prohibit relocation of data to avoid exposure Overseas data storage can pose entirely different set of risks EU standards are higher than US s 18

19 19 Contract Example: Los Angeles/Google apps contract requires LA to receive its full storehouse of data within 5 days of request and data moved to any location of LA s choosing, including alternative vendor; data must also exist as standard format that wouldn t incur added costs to LA to store in environment other than Google s

20 Don t assume contract provides adequate customer data protection Ask tough questions! Consider getting a security or risk assessment from a neutral third party before committing to a cloud service provider Don t assume there s no room to 20 negotiate even with boilerplate contracts

21 Heartland Payment Systems 2007 security breach of Visa card issuers info settlements of $65+ million vs. City of Los Angeles & CSC s customized, five year contract of Google apps 21

22 Today s Forecast: Is bright and sunny, with an 80% chance that I m wrong. Thanks for tuning in. 22

23 Daniel T. Graham Clark Hill PLC 150 North Michigan Avenue Suite 2700 Chicago, Illinois

Information Security: Cloud Computing

Information Security: Cloud Computing Information Security: Cloud Computing Simon Taylor MSc CLAS CISSP CISMP PCIRM Director & Principal Consultant All Rights Reserved. Taylor Baines Limited is a Registered Company in England & Wales. Registration

More information

Cloud Computing: Legal Risks and Best Practices

Cloud Computing: Legal Risks and Best Practices Cloud Computing: Legal Risks and Best Practices A Bennett Jones Presentation Toronto, Ontario Lisa Abe-Oldenburg, Partner Bennett Jones LLP November 7, 2012 Introduction Security and Data Privacy Recent

More information

Risk Management of Outsourced Technology Services. November 28, 2000

Risk Management of Outsourced Technology Services. November 28, 2000 Risk Management of Outsourced Technology Services November 28, 2000 Purpose and Background This statement focuses on the risk management process of identifying, measuring, monitoring, and controlling the

More information

How to ensure control and security when moving to SaaS/cloud applications

How to ensure control and security when moving to SaaS/cloud applications How to ensure control and security when moving to SaaS/cloud applications Stéphane Hurtaud Partner Information & Technology Risk Deloitte Laurent de la Vaissière Directeur Information & Technology Risk

More information

Legal Issues in the Cloud: A Case Study. Jason Epstein

Legal Issues in the Cloud: A Case Study. Jason Epstein Legal Issues in the Cloud: A Case Study Jason Epstein Outline Overview of Cloud Computing Service Models (SaaS, PaaS, IaaS) Deployment Models (Private, Community, Public, Hybrid) Adoption Different types

More information

Cloud Computing Overview & Security Issues

Cloud Computing Overview & Security Issues Cloud Computing Overview & Security Issues Author- Hitesh Malviya(Information Security analyst) Qualifications: C!EH, EC!SA, MCITP, CCNA, MCP Current Position: CEO at HCF Infosec Limited Contact: hitesh@hcf.co.in,

More information

Negotiating EHR Acquisition Contracts

Negotiating EHR Acquisition Contracts Negotiating EHR Acquisition Contracts Key Strategies, Terms and Conditions Louisa Barash, Esq. & Jane Eckels, Esq. The Art and Skill of Negotiations Painful Contract Negotiations Take too long Are too

More information

Legal Issues Associated with Cloud Computing. Laurin H. Mills May 13, 2009

Legal Issues Associated with Cloud Computing. Laurin H. Mills May 13, 2009 Legal Issues Associated with Cloud Computing Laurin H. Mills May 13, 2009 What Is Cloud Computing? The cloud is a metaphor for the Internet Leverages the connectivity of the Internet to optimize the utility

More information

Cloud Computing Risks in Financial Services Companies: How Attorneys Can Best Help In An Increasingly SaaS-ified World

Cloud Computing Risks in Financial Services Companies: How Attorneys Can Best Help In An Increasingly SaaS-ified World Cloud Computing Risks in Financial Services Companies: How Attorneys Can Best Help In An Increasingly SaaS-ified World July 30, 2015 Sutherland Webinar Michael Steinig 202.383.0804 Michael.Steinig@sutherland.com

More information

Software as a Service Decision Guide and Best Practices

Software as a Service Decision Guide and Best Practices Software as a Service Decision Guide and Best Practices Purpose of this document Software as a Service (SaaS) is software owned, delivered and managed remotely by one or more providers [Gartner, SaaS Hype

More information

A Checklist for Software as a Service (SaaS) Vendors and Application Service Providers

A Checklist for Software as a Service (SaaS) Vendors and Application Service Providers A Checklist for Software as a Service (SaaS) Vendors and Application Service Providers This checklist is a longer version of a SaaS Checklist that appeared in the July 2009 issue of LAWPRO Magazine at

More information

Security & Trust in the Cloud

Security & Trust in the Cloud Security & Trust in the Cloud Ray Trygstad Director of Information Technology, IIT School of Applied Technology Associate Director, Information Technology & Management Degree Programs Cloud Computing Primer

More information

Information Security Handbook

Information Security Handbook Information Security Handbook Adopted 6/4/14 Page 0 Page 1 1. Introduction... 5 1.1. Executive Summary... 5 1.2. Governance... 5 1.3. Scope and Application... 5 1.4. Biennial Review... 5 2. Definitions...

More information

Schedule 5: SaaS Premium Service Level Agreement

Schedule 5: SaaS Premium Service Level Agreement Schedule 5: SaaS Premium Service Level Agreement Service Level Agreement Number - - - - - _- _- _- _ ( ) Document Version: SLA (with SAAS) V_1_4 Contents 1. Provision of Service Warranty 3 1.1. Formula

More information

Technology Risk Management

Technology Risk Management 1 Monetary Authority of Singapore Technology Risk Guidelines & Notices New Requirements for Financial Services Industry Mark Ames Director, Seminar Program ISACA Singapore 2 MAS Supervisory Framework Impact

More information

Cloud Computing Risks & Reality. Sandra Liepkalns, CRISC sandra.liepkalns@netrus.com

Cloud Computing Risks & Reality. Sandra Liepkalns, CRISC sandra.liepkalns@netrus.com Cloud Computing Risks & Reality Sandra Liepkalns, CRISC sandra.liepkalns@netrus.com What is Cloud Security The quality or state of being secure to be free from danger & minimize risk To be protected from

More information

TO: Chief Executive Officers of National Banks, Federal Branches and Data-Processing Centers, Department and Division Heads, and Examining Personnel

TO: Chief Executive Officers of National Banks, Federal Branches and Data-Processing Centers, Department and Division Heads, and Examining Personnel AL 2000 12 O OCC ADVISORY LETTER Comptroller of the Currency Administrator of National Banks Subject: Risk Management of Outsourcing Technology Services TO: Chief Executive Officers of National Banks,

More information

Contracting Guidelines with EHR Vendors

Contracting Guidelines with EHR Vendors Doctors Office Quality - Information Technology (DOQ-IT) Project Contracting Guidelines with EHR Vendors In general, if a contract is presented to your group from a software company, it will be written

More information

White Paper THE FIVE STEPS TO MANAGING THIRD-PARTY RISK. By James Christiansen, VP, Information Risk Management

White Paper THE FIVE STEPS TO MANAGING THIRD-PARTY RISK. By James Christiansen, VP, Information Risk Management White Paper THE FIVE STEPS TO MANAGING THIRD-PARTY RISK By James Christiansen, VP, Information Management Executive Summary The Common Story of a Third-Party Data Breach It begins with a story in the newspaper.

More information

VENDOR MANAGEMENT. General Overview

VENDOR MANAGEMENT. General Overview VENDOR MANAGEMENT General Overview With many organizations outsourcing services to other third-party entities, the issue of vendor management has become a noted topic in today s business world. Vendor

More information

Cyber and Data Security. Proposal form

Cyber and Data Security. Proposal form Cyber and Data Security Proposal form This proposal form must be completed and signed by a principal, director or a partner of the proposed insured. Cover and Quotation requirements Please indicate which

More information

Anatomy of a Cloud Computing Data Breach

Anatomy of a Cloud Computing Data Breach Anatomy of a Cloud Computing Data Breach Sheryl Falk Mike Olive ACC Houston Chapter ITPEC Practice Group September 18, 2014 1 Agenda Ø Cloud 101 Welcome to Cloud Computing Ø Cloud Agreement Considerations

More information

REGULATIONS FOR THE SECURITY OF INTERNET BANKING

REGULATIONS FOR THE SECURITY OF INTERNET BANKING REGULATIONS FOR THE SECURITY OF INTERNET BANKING PAYMENT SYSTEMS DEPARTMENT STATE BANK OF PAKISTAN Table of Contents PREFACE... 3 DEFINITIONS... 4 1. SCOPE OF THE REGULATIONS... 6 2. INTERNET BANKING SECURITY

More information

The Use of Cloud Computing for the Storing and Accessing of Client Information: Some Practical and Ethical Considerations

The Use of Cloud Computing for the Storing and Accessing of Client Information: Some Practical and Ethical Considerations The Use of Cloud Computing for the Storing and Accessing of Client Information: Some Practical and Ethical Considerations Jeffrey D. Scott Jeffrey D. Scott, Legal Professional Corporation Practice Advisors

More information

24/7 Monitoring Pro-Active Support High Availability Hardware & Software Helpdesk. itg CloudBase

24/7 Monitoring Pro-Active Support High Availability Hardware & Software Helpdesk. itg CloudBase 24/7 Monitoring Pro-Active Support High Availability Hardware & Software Helpdesk Onsite Support itg CloudBase Pro-Active managed it support services for one single cost per month covers all aspects of

More information

Outsourcing Technology Services A Management Decision

Outsourcing Technology Services A Management Decision Outsourcing Technology Services A Management Decision A Telephone Seminar for National Banks Tuesday, July 20, 2004 And again on Wednesday, July 21, 2004 Agenda Outsourcing activities and relationships

More information

Auditing Cloud Computing and Outsourced Operations

Auditing Cloud Computing and Outsourced Operations Session 136 Auditing Cloud Computing and Outsourced Operations Monday, May 7, 2012 3:30 PM 5:00 PM Mike Schiller Director of Sales & Marketing IT, Texas Instruments Co Author, IT Auditing: Using Controls

More information

OUTSOURCING IT FUNCTIONS IN TIMES OF INCREASED REGULATION AND SECURITY CONCERNS. 2016 In-House Counsel Conference

OUTSOURCING IT FUNCTIONS IN TIMES OF INCREASED REGULATION AND SECURITY CONCERNS. 2016 In-House Counsel Conference OUTSOURCING IT FUNCTIONS IN TIMES OF INCREASED REGULATION AND SECURITY CONCERNS 2016 In-House Counsel Conference INTRODUCTION http://delvacca.acc.com http://delvacca.acc.com Presenters: Barbara Murphy

More information

Las Vegas Datacenter Overview. Product Overview and Data Sheet. Created on 6/18/2014 3:49:00 PM

Las Vegas Datacenter Overview. Product Overview and Data Sheet. Created on 6/18/2014 3:49:00 PM Las Vegas Datacenter Overview Product Overview and Data Sheet Product Data Sheet Maintaining a Software as a Service (SaaS) environment with market leading availability and security is something that Active

More information

Cloud Computing. Hot topics in relation to security, liability and privacy. Steven De Schrijver

Cloud Computing. Hot topics in relation to security, liability and privacy. Steven De Schrijver Cloud Computing Hot topics in relation to security, liability and privacy Steven De Schrijver Cloud Computing : who and what is involved? Data Cloud Service Provider (e.g. SaaS, PaaS, IaaS) Sub-contractor

More information

ISO 27001 COMPLIANCE WITH OBSERVEIT

ISO 27001 COMPLIANCE WITH OBSERVEIT ISO 27001 COMPLIANCE WITH OBSERVEIT OVERVIEW ISO/IEC 27001 is a framework of policies and procedures that include all legal, physical and technical controls involved in an organization s information risk

More information

Cloud Computing. Making legal aspects less cloudy. Erik Luysterborg Partner Cyber Security & Privacy Belgium EMEA Data Protection & Privacy Leader

Cloud Computing. Making legal aspects less cloudy. Erik Luysterborg Partner Cyber Security & Privacy Belgium EMEA Data Protection & Privacy Leader Cloud Computing Making legal aspects less cloudy Erik Luysterborg Partner Cyber Security & Privacy Belgium EMEA Data Protection & Privacy Leader 30 September 2014 1 Contents A. Introduction: a short walk

More information

Why You Should Consider Cloud- Based Email Archiving. A whitepaper by The Radicati Group, Inc.

Why You Should Consider Cloud- Based Email Archiving. A whitepaper by The Radicati Group, Inc. . The Radicati Group, Inc. 1900 Embarcadero Road, Suite 206 Palo Alto, CA 94303 Phone 650-322-8059 Fax 650-322-8061 http://www.radicati.com THE RADICATI GROUP, INC. Why You Should Consider Cloud- Based

More information

Introduction to Cloud Computing. Srinath Beldona srinath_beldona@yahoo.com

Introduction to Cloud Computing. Srinath Beldona srinath_beldona@yahoo.com Introduction to Cloud Computing Srinath Beldona srinath_beldona@yahoo.com Agenda Pre-requisites Course objectives What you will learn in this tutorial? Brief history Is cloud computing new? Why cloud computing?

More information

Data Management: Considerations for Integrating Compliance Requirements At Home and Abroad. Toronto, Ontario June 14, 2005

Data Management: Considerations for Integrating Compliance Requirements At Home and Abroad. Toronto, Ontario June 14, 2005 Data Management: Considerations for Integrating Compliance Requirements At Home and Abroad Toronto, Ontario June 14, 2005 Outsourcing Update: New Contractual Options and Risks Lisa K. Abe June 14, 2005

More information

Cloud Computing: Contracting and Compliance Issues for In-House Counsel

Cloud Computing: Contracting and Compliance Issues for In-House Counsel International In-house Counsel Journal Vol. 6, No. 23, Spring 2013, 1 Cloud Computing: Contracting and Compliance Issues for In-House Counsel SHAHAB AHMED Director Legal and Corporate Affairs, Microsoft,

More information

The Difference Between Disaster Recovery and Business Continuance

The Difference Between Disaster Recovery and Business Continuance The Difference Between Disaster Recovery and Business Continuance In high school geometry we learned that a square is a rectangle, but a rectangle is not a square. The same analogy applies to business

More information

Top 10 Risks in the Cloud

Top 10 Risks in the Cloud A COALFIRE PERSPECTIVE Top 10 Risks in the Cloud by Balaji Palanisamy, VCP, QSA, Coalfire March 2012 DALLAS DENVER LOS ANGELES NEW YORK SEATTLE Introduction Business leaders today face a complex risk question

More information

Type of Personal Data We Collect and How We Use It

Type of Personal Data We Collect and How We Use It Philips Lumify App Privacy Notice This Privacy Notice was last changed on September 1, 2015. Philips Electronics North America Corporation ("Philips") strongly believes in protecting the privacy of the

More information

A COMPLETE GUIDE HOW TO CHOOSE A CLOUD-TO-CLOUD BACKUP PROVIDER FOR THE ENTERPRISE

A COMPLETE GUIDE HOW TO CHOOSE A CLOUD-TO-CLOUD BACKUP PROVIDER FOR THE ENTERPRISE A COMPLETE GUIDE HOW TO CHOOSE A CLOUD-TO-CLOUD BACKUP PROVIDER FOR THE ENTERPRISE Contents How to Buy Cloud-to-Cloud Backup...................... 4 Wait What is Cloud-to-Cloud Backup?.....................

More information

Assessing the Security Risks of Cloud Computing

Assessing the Security Risks of Cloud Computing Research Publication Date: 3 June 2008 ID Number: G00157782 Assessing the Security Risks of Cloud Computing Jay Heiser, Mark Nicolett Organizations considering cloud-based services must understand the

More information

Cloud Vendor Evaluation

Cloud Vendor Evaluation Cloud Vendor Evaluation Checklist Life Sciences in the Cloud Cloud Vendor Evaluation Checklist What to evaluate when choosing a cloud vendor in Life Sciences Cloud computing is radically changing business

More information

Top 10 Cloud Risks That Will Keep You Awake at Night

Top 10 Cloud Risks That Will Keep You Awake at Night Top 10 Cloud Risks That Will Keep You Awake at Night Shankar Babu Chebrolu Ph.D., Vinay Bansal, Pankaj Telang Photo Source flickr.com .. Amazon EC2 (Cloud) to host Eng. Lab testing. We want to use SalesForce.com

More information

CA API Management SaaS

CA API Management SaaS SaaS Listing CA API Management SaaS 1. Introduction This document provides standards and features that apply to the CA API Management SaaS offering ( Service ) provided to the Customer and defines the

More information

Managed Security Services for Data

Managed Security Services for Data A v a y a G l o b a l S e r v i c e s Managed Security Services for Data P r o a c t i v e l y M a n a g i n g Y o u r N e t w o r k S e c u r i t y 2 4 x 7 x 3 6 5 IP Telephony Contact Centers Unified

More information

SAAS MADE EASY: SERVICE LEVEL AGREEMENT

SAAS MADE EASY: SERVICE LEVEL AGREEMENT SAAS MADE EASY: SERVICE LEVEL AGREEMENT THIS SERVICE LEVEL AGREEMENT DEFINES THE SERVICE LEVELS PROVIDED TO YOU BY THE COMPANY ( SaaS Made Easy ). Capitalized terms used herein but not otherwise defined

More information

Attachment A. Identification of Risks/Cybersecurity Governance

Attachment A. Identification of Risks/Cybersecurity Governance Attachment A Identification of Risks/Cybersecurity Governance 1. For each of the following practices employed by the Firm for management of information security assets, please provide the month and year

More information

Norwegian Data Inspectorate

Norwegian Data Inspectorate Norwegian Data Inspectorate Narvik kommune Postboks 64 8501 NARVIK Norway Your reference Our reference (please quote in any reply) Date 1111/1210-6/PEJA 11/00593-7/SEV 16 January 2012 Notification of decision

More information

SELECTING AN ENTERPRISE-READY CLOUD SERVICE

SELECTING AN ENTERPRISE-READY CLOUD SERVICE 21 Point Checklist for SELECTING AN ENTERPRISE-READY CLOUD SERVICE Brought to you by Introduction The journey to the cloud is well underway, and it s easy to see why when 84% of CIOs report cutting application

More information

THIS SERVICE LEVEL AGREEMENT DEFINES THE SERVICE LEVELS PROVIDED TO YOU BY THE COMPANY.

THIS SERVICE LEVEL AGREEMENT DEFINES THE SERVICE LEVELS PROVIDED TO YOU BY THE COMPANY. THIS SERVICE LEVEL AGREEMENT DEFINES THE SERVICE LEVELS PROVIDED TO YOU BY THE COMPANY. Capitalized terms used herein but not otherwise defined shall have their respective meanings set forth in the End

More information

Information Disclosure Reference Guide for Cloud Service Providers

Information Disclosure Reference Guide for Cloud Service Providers Information Disclosure Reference Guide for Cloud Service Providers In Conjunction with "Guide to Safe Use of Cloud Services for Small-to-Mid-Sized Enterprises" April 2011 Information-technology Promotion

More information

Managing the Risks of Operating in the Cloud

Managing the Risks of Operating in the Cloud National Association of College and University Business Officers Managing the Risks of Operating in the Cloud By Philip D. Porter and Michael E. Larner www.nacubo.org We Mean Business in Higher Education

More information

Services Providers. Ivan Soto

Services Providers. Ivan Soto SOP s for Managing Application Services Providers Ivan Soto Learning Objectives At the end of this session we will have covered: Types of Managed Services Outsourcing process Quality expectations for Managed

More information

CLOUD COMPUTING FOR SMALL- AND MEDIUM-SIZED ENTERPRISES:

CLOUD COMPUTING FOR SMALL- AND MEDIUM-SIZED ENTERPRISES: CLOUD COMPUTING FOR SMALL- AND MEDIUM-SIZED ENTERPRISES: Privacy Responsibilities and Considerations Cloud computing is the delivery of computing services over the Internet, and it offers many potential

More information

Information Technology: This Year s Hot Issue - Cloud Computing

Information Technology: This Year s Hot Issue - Cloud Computing Information Technology: This Year s Hot Issue - Cloud Computing Presented by: Alan Sutin Global IP & Technology Practice Group GREENBERG TRAURIG, LLP ATTORNEYS AT LAW WWW.GTLAW.COM 2011. All rights reserved.

More information

White Paper on Financial Institution Vendor Management

White Paper on Financial Institution Vendor Management White Paper on Financial Institution Vendor Management Virtually every organization in the modern economy relies to some extent on third-party vendors that facilitate business operations in a wide variety

More information

Cloud Security: The Grand Challenge

Cloud Security: The Grand Challenge Dr. Paul Ashley IBM Software Group pashley@au1.ibm.com Cloud Security: The Grand Challenge Outline Cloud computing: the pros, the cons, the blind spots Security in the cloud - what are the risks now and

More information

CITY UNIVERSITY OF HONG KONG Information Security Incident Management Standard

CITY UNIVERSITY OF HONG KONG Information Security Incident Management Standard CITY UNIVERSITY OF HONG KONG Information Security Incident Management Standard (Approved by the Information Strategy and Governance Committee in December 2013; revision 1.1 approved by Chief Information

More information

Healthcare Payment Processing: Managing Data Security and Privacy Risks

Healthcare Payment Processing: Managing Data Security and Privacy Risks Moderator: Linda A. Malek Chair, Healthcare Moses & Singer LLP Healthcare Payment Processing: Managing Data Security and Privacy Risks Thursday, September 13, 2012 Panelists: Beth L. Rubin Senior Counsel

More information

Dean Bank Primary and Nursery School. Secure Storage of Data and Cloud Storage

Dean Bank Primary and Nursery School. Secure Storage of Data and Cloud Storage Dean Bank Primary and Nursery School Secure Storage of Data and Cloud Storage January 2015 All school e-mail is disclosable under Freedom of Information and Data Protection legislation. Be aware that anything

More information

Securing the Service Desk in the Cloud

Securing the Service Desk in the Cloud TECHNICAL WHITE PAPER Securing the Service Desk in the Cloud BMC s Security Strategy for ITSM in the SaaS Environment Introduction Faced with a growing number of regulatory, corporate, and industry requirements,

More information

WHITE PAPER. How to choose and implement your cloud strategy

WHITE PAPER. How to choose and implement your cloud strategy WHITE PAPER How to choose and implement your cloud strategy INTRODUCTION Cloud computing has the potential to tip strategic advantage away from large established enterprises toward SMBs or startup companies.

More information

Electronic business conditions of use

Electronic business conditions of use Electronic business conditions of use This document provides Water Corporation s Electronic Business Conditions of Use. These are to be applied to all applications, which are developed for external users

More information

Contracting for Cloud Computing

Contracting for Cloud Computing Contracting for Cloud Computing Geofrey L Master Mayer Brown JSM Partner +852 2843 4320 geofrey.master@mayerbrownjsm.com April 5th 2011 Mayer Brown is a global legal services organization comprising legal

More information

Disaster Recovery as a Service 2013

Disaster Recovery as a Service 2013 Disaster Recovery as a Service 2013 Whitepaper In India, the DRaaS offering gains huge significance because of various reasons: frequent occurrence of earthquakes and heavy rains, unrest in various parts

More information

A LEGAL GUIDE TO CLOUD COMPUTING

A LEGAL GUIDE TO CLOUD COMPUTING A LEGAL GUIDE TO CLOUD COMPUTING INTRODUCTION Many companies are considering implementation of cloud computing services to decrease IT costs while providing the flexibility to scale usage on demand. The

More information

Outsourced Third Party Relationship Management/ Vendor Management. TTS Webinar July 15, 2015 Susan Orr CISA, CISM, CRISC, CRP

Outsourced Third Party Relationship Management/ Vendor Management. TTS Webinar July 15, 2015 Susan Orr CISA, CISM, CRISC, CRP Outsourced Third Party Relationship Management/ Vendor Management TTS Webinar July 15, 2015 Susan Orr CISA, CISM, CRISC, CRP 1 Risk Management Guidance 2 3 Appendix J: 4 - Key Elements Third Party Management

More information

CLOUD COMPUTING ISSUES FOR SCHOOL DISTRICTS. Presented to the 2013 BRADLEY F. KIDDER LAW CONFERENCE. October 2, 2013

CLOUD COMPUTING ISSUES FOR SCHOOL DISTRICTS. Presented to the 2013 BRADLEY F. KIDDER LAW CONFERENCE. October 2, 2013 CLOUD COMPUTING ISSUES FOR SCHOOL DISTRICTS Presented to the 2013 BRADLEY F. KIDDER LAW CONFERENCE October 2, 2013 By: Diane M. Gorrow Soule, Leslie, Kidder, Sayward & Loughman, P.L.L.C. 220 Main Street

More information

VENDOR RISK MANAGEMENT UPDATE- ARE YOU AT RISK? Larry L. Llirán, CISA, CISM December 10, 2015 ISACA Puerto Rico Symposium

VENDOR RISK MANAGEMENT UPDATE- ARE YOU AT RISK? Larry L. Llirán, CISA, CISM December 10, 2015 ISACA Puerto Rico Symposium 1 VENDOR RISK MANAGEMENT UPDATE- ARE YOU AT RISK? Larry L. Llirán, CISA, CISM December 10, 2015 ISACA Puerto Rico Symposium 2 Agenda Introduction Vendor Management what is? Available Guidance Vendor Management

More information

Please read through these Terms and Conditions carefully, these Terms and Conditions apply to all services with us, unless otherwise stated.

Please read through these Terms and Conditions carefully, these Terms and Conditions apply to all services with us, unless otherwise stated. Terms and Conditions Last Updated 01/07/2014 Please read through these Terms and Conditions carefully, these Terms and Conditions apply to all services with us, unless otherwise stated. is a registered

More information

Making the leap to the cloud: IS my data private and secure?

Making the leap to the cloud: IS my data private and secure? Making the leap to the cloud: IS my data private and secure? tax & accounting MAKING THE LEAP TO THE CLOUD: IS MY DATA PRIVATE AND SECURE? Cloud computing: What s in it for me? The more you know about

More information

WHY YOU SHOULD CONSIDER CLOUD BASED EMAIL ARCHIVING.

WHY YOU SHOULD CONSIDER CLOUD BASED EMAIL ARCHIVING. WHY YOU SHOULD CONSIDER CLOUD BASED EMAIL ARCHIVING. INTRODUCTION A vast majority of information today is being exchanged via email. In 2011, the average corporate user will send and receive about 112

More information

Vendor Management Best Practices

Vendor Management Best Practices 23 rd Annual and One Day Seminar Vendor Management Best Practices Catherine Bruder CPA, CITP, CISA, CISM, CTGA Michigan Texas Florida Insight. Oversight. Foresight. SM Doeren Mayhew Bruder 1 $100 billion

More information

security in the cloud White Paper Series

security in the cloud White Paper Series security in the cloud White Paper Series 2 THE MOVE TO THE CLOUD Cloud computing is being rapidly embraced across all industries. Terms like software as a service (SaaS), infrastructure as a service (IaaS),

More information

Every Cloud Has A Silver Lining. Protecting Privilege Data In A Hosted World

Every Cloud Has A Silver Lining. Protecting Privilege Data In A Hosted World Every Cloud Has A Silver Lining Protecting Privilege Data In A Hosted World May 7, 2014 Introduction Lindsay Stevens Director of Software Development Liquid Litigation Management, Inc. lstevens@llminc.com

More information

Cloud Computing in a Government Context

Cloud Computing in a Government Context Cloud Computing in a Government Context Introduction There has been a lot of hype around cloud computing to the point where, according to Gartner, 1 it has become 'deafening'. However, it is important

More information

Cloud Computing and Records Management

Cloud Computing and Records Management GPO Box 2343 Adelaide SA 5001 Tel (+61 8) 8204 8773 Fax (+61 8) 8204 8777 DX:336 srsarecordsmanagement@sa.gov.au www.archives.sa.gov.au Cloud Computing and Records Management June 2015 Version 1 Version

More information

What Every User Needs To Know Before Moving To The Cloud. LawyerDoneDeal Corp.

What Every User Needs To Know Before Moving To The Cloud. LawyerDoneDeal Corp. What Every User Needs To Know Before Moving To The Cloud LawyerDoneDeal Corp. What Every User Needs To Know Before Moving To The Cloud 1 What is meant by Cloud Computing, or Going To The Cloud? A model

More information

MOVING INTO THE DATA CENTRE: BEST PRACTICES FOR SUCCESSFUL COLOCATION

MOVING INTO THE DATA CENTRE: BEST PRACTICES FOR SUCCESSFUL COLOCATION MOVING INTO THE DATA CENTRE: BEST PRACTICES FOR SUCCESSFUL COLOCATION CONTENTS Overview _ 2 FINDING THE RIGHT DATA CENTRE FOR YOUR BUSINESS _ 3 PREPARING FOR THE MOVE 6 MAKING THE MOVE _ 8 summary _ 9

More information

Design of Database Security Policy In Enterprise Systems

Design of Database Security Policy In Enterprise Systems Design of Database Security Policy In Enterprise Systems by Krishna R Singitam Database Architect Page 1 of 10 Table of Contents 1. Abstract... 3 2. Introduction... 3 2.1. Understanding the Necessity of

More information

Contracting Guidelines with EHR Vendors

Contracting Guidelines with EHR Vendors Contracting Guidelines with EHR Vendors In general, if a contract is presented to your group from a software company, it will be written from the perspective of the software company. You can request language

More information

Cloud Computing in Vermont State Government

Cloud Computing in Vermont State Government Cloud Computing in Vermont State Government Analysis of Opportunities Duncan Goss, Legislative Director of Information Technology David Tucker, State CIO Introduction Legislation passed during the 2009

More information

Checklist for a Watertight Cloud Computing Contract

Checklist for a Watertight Cloud Computing Contract Checklist for a Watertight Cloud Computing Contract Companies of all industries are recognizing the need and benefit of moving some if not all of their IT infrastructure to a Cloud whether public or private.

More information

INNOVATE. MSP Services Overview SVEN RADEMACHER THROUGH MOTIVATION

INNOVATE. MSP Services Overview SVEN RADEMACHER THROUGH MOTIVATION INNOVATE THROUGH MOTIVATION MSP Services Overview SVEN RADEMACHER Agenda About us IT Challenges Our Approach Our Services Next Steps About Us SEAFAIR IT SOLUTIONS Pre-eminent Managed Service Provider Provide

More information

HARNESSING THE POWER OF THE CLOUD

HARNESSING THE POWER OF THE CLOUD HARNESSING THE POWER OF THE CLOUD Demystifying Cloud Computing Everyone is talking about the cloud nowadays. What does it really means? Indeed, cloud computing is the current stage in the Internet evolution.

More information

Whitepaper. Five Reasons Businesses Should Consider Hosted Messaging and Collaboration Solutions. www.softcom.com/business

Whitepaper. Five Reasons Businesses Should Consider Hosted Messaging and Collaboration Solutions. www.softcom.com/business Whitepaper Five Reasons Businesses Should Consider Hosted Messaging and Collaboration Solutions www.softcom.com/business Whitepaper Five Reasons Businesses Should Consider Hosted Messaging and Collaboration

More information

Cloud Services and Business Process Outsourcing

Cloud Services and Business Process Outsourcing Cloud Services and Business Process Outsourcing What security concerns surround Cloud Services and Outsourcing? Prepared for the Western NY ISACA Conference April 28 2015 Presenter Kevin Wilkins, CISSP

More information

Cloud Computing; is it right for my business?

Cloud Computing; is it right for my business? Cloud Computing; is it right for my business? There is discussion in the business community about the viability of Cloud computing, a style of computing in which software and applications are provided

More information

THIS SERVICE LEVEL AGREEMENT DEFINES THE SERVICE LEVELS PROVIDED TO YOU BY THE COMPANY ( Exchange My Mail ).

THIS SERVICE LEVEL AGREEMENT DEFINES THE SERVICE LEVELS PROVIDED TO YOU BY THE COMPANY ( Exchange My Mail ). THIS SERVICE LEVEL AGREEMENT DEFINES THE SERVICE LEVELS PROVIDED TO YOU BY THE COMPANY ( Exchange My Mail ). I. Service Definition. Exchange My Mail will provide Hosted Exchange and other Application Services

More information

How not to lose your head in the Cloud: AGIMO guidelines released

How not to lose your head in the Cloud: AGIMO guidelines released How not to lose your head in the Cloud: AGIMO guidelines released 07 December 2011 In brief The Australian Government Information Management Office has released a helpful guide on navigating cloud computing

More information

LAWYERING IN THE CLOUD CRIB NOTES 2012 Charles F. Luce, Jr. coloradolegalethics.com/ (alpha release)

LAWYERING IN THE CLOUD CRIB NOTES 2012 Charles F. Luce, Jr. coloradolegalethics.com/ (alpha release) CHARLES LUCE S LAWYERING IN THE CLOUD CRIB NOTES 2012 Charles F. Luce, Jr. coloradolegalethics.com/ (alpha release) A. Cloud Computing Defined: n. A loosely defined term for any system providing access

More information

A Global IT Managed Service Provider

A Global IT Managed Service Provider A Global IT Managed Service Provider Service Catalog 2013 www.presilient.com We help ensure that you maximize your current infrastructure investments, while increasing performance across your enterprise.

More information

CLOUD COMPUTING. 11 December 2013 TOWNSHIP OF KING TATTA 1

CLOUD COMPUTING. 11 December 2013 TOWNSHIP OF KING TATTA 1 CLOUD COMPUTING (outsourcing records storage) TATTA SRINIVASA RECORDS MANAGER 11 December 2013 TOWNSHIP OF KING TATTA 1 Cloud computing A style of computing where scalable and elasticity ITenabled capabilities

More information

Office of the City Auditor and Clerk

Office of the City Auditor and Clerk Office of the City Auditor and Clerk Externally Hosted IBM iseries System Arrangement For Utility Billing System Final Executive Summary Internal Audit Report Internal Audit Project # 08-05 May 28, 2008

More information

Cloud Backup GLOSSARY

Cloud Backup GLOSSARY Cloud Backup GLOSSARY There are a number of confusing terms bandied about in the marketplace today regarding cloud computing, data backup and storage systems so much so that consumers, professionals and

More information

Considerations for firms thinking of using third-party technology (off-the-shelf) banking solutions

Considerations for firms thinking of using third-party technology (off-the-shelf) banking solutions Financial Conduct Authority Considerations for firms thinking of using third-party technology (off-the-shelf) banking solutions Introduction 1. A firm has many choices when designing its operating model

More information

Cyber Security Pr o t e c t i n g y o u r b a n k a g a i n s t d a t a b r e a c h e s

Cyber Security Pr o t e c t i n g y o u r b a n k a g a i n s t d a t a b r e a c h e s Cyber Security Pr o t e c t i n g y o u r b a n k a g a i n s t d a t a b r e a c h e s 1 Agenda Data Security Trends Root causes of Cyber Attacks How can we fix this? Secure Infrastructure Security Practices

More information